[INFO REQ] Details on CIQ from DEV's

[twolostminds]

By now anyone who has an Android phone has heard about CarrierIQ, CIQ or IQAgent. Business Wire in London announced on June 8th:

LONDON--(BUSINESS WIRE)--Carrier IQ, today announced availability of a new Application Analytics module that will enable mobile operators and device manufacturers to monitor application performance and usage across multiple mobile device platforms, including tablet devices. Carrier IQ’s technology provides mobile network operators and device manufacturers with invaluable insights into the performance of various devices and networks from the user’s perspective. Carrier IQ’s solution is deployed on over 150 million mobile devices including smartphones, feature phones, data cards, radio-equipped devices, downloadable agents and now tablet devices.

For the few who may be scratching their heads wondering what CarrierIQ is...
Steve Topletz, a member of an international group of hackers, human rights workers, lawyers and artists that fights internet censorship and promotes the right to privacy has described it as follows:

Carrier IQ as a platform is designed to collect "metrics" at any
scale. What I found it to hook into is far beyond the scope of
anything a carrier needs - or should want - to be collecting.
Carrier IQ sits in the middle of, and "checks" the data of, SMS and
MMS messages. It listens for and receives every battery change
notifications. It hooks into every web page you view, and every XML
file your device reads. It receives every press of the touch screen.
It 'sees' what you type on the physical keyboard. It reads every
number you press in the dialer. It can track which applications you
use, what 'type' they are, how often, and for how long. It hooks into
data sent and received.

Information on CarrierIQ can also be found in the ACS SFR Epic4G ROM discussion thread and a thread I started requesting information from Epic4G Dev's here.

References to CIQ have been found deeply embedded Epic4G

Provided by chris41g
to be effectively removed you only need to remove it from 4 files. it is referenced elsewhere scattered throughout... but the four main files are
DialerTabActivity.apk
ext.jar
framework.jar
services.jar

then in the kernels initramfs, you have to disable the service in the init.rc


Provided by mkasick
Here's all the files that reference "CIQ", "carrieriq", or "libiq" with instances unrelated to Carrier IQ removed:

/ (initramfs):
- init: /dev/ttyCIQ0 UART, presumably to communicate with radio.
- init.rc: Start iqmsd service if property:service.iq.active=1.
- lib/modules/dpram.ko: Implements ttyCIQ UARTs.

/system:
- app/DialerTabActivity.odex
- app/FactoryTest.odex
- bin/iqmsd
- framework/ext.odex
- framework/framework.odex
- framework/sec_feature.odex
- framework/services.odex
- lib/libiq_client.so
- lib/libiq_service.so

Of these, bin/iqmsd is a purpose-unknown daemon, and libiq_client.so & libiq_service.so the client & service native code. The client & service managed code is implemented in framework/ext.odex & framework/framework.odex respectively.

In addition, the following framework classes reference Carrier IQ in some fashion:

framework/ext.odex:
- org.apache.http.impl.client.DefaultRequestDirector

framework.framework.odex:
- android.inputmethodservice.InputMethodService
- android.net.http.Request
- android.webkit.{BrowserFrame,CallbackProxy,LoadLis tener,WebViewCore}
- com.android.internal.telephony.SMSDispatcher

framework.services.odex:
- com.android.server.BatteryService
- com.android.server.WindowManagerService
- com.android.server.am.UsageStatsService

Finally, libiq_service.so is used exclusively by framework/framework.odex (com.carrieriq.iqagent.client.NativeClient), and libiq_client.so is used by:
- bin/iqmsd
- framework/ext.odex (com.carrieriq.iqagent.service.IQService)
- lib/libopencore_player.so

Makes you wonder what might be in the closed source.

The Android platform, like Linux, is based on openness. I am calling on all Android developers, programmers, hackers and users to band together as a community and come forward with any information you may have on CarrierIQ.
I am asking all those with the knowledge and resources to delve deeper into this issue to please do so and help spread the truth.

For anyone who wishes to contribute confidentially and anonymously please email:
CIQINVESTIGATION @ VERIZON dot NET

 

[twolostminds]

Below are some of the most recent statements made by Sprint in response to questions concerning CarrierIQ:

“The software that is in the Android phones is supplied by Google themselves as well as the manufacturer. We (Sprint) has no control over the actual operating system supplied to us such as the Carrier IQ as it is indigenous to the Android platform.”

“Removing the Carrier IQ software from your Samsung Epic device can void your manufacturer warranty.”

“I appreciate you taking the time to speak with me today. I understand your concerns about the Carrier IQ software and how it can access personal information on the device. As discussed on our call, we are committed to protecting our customers personal information.”

My questions were directed towards Sprint about CarrieriIQ and the Samsung Galaxy S Epic4G because that is my service and phone. I would love to hear from others on their experiences when questioning their carriers about CarrierIQ on Android phones.

I have contacted CarrierIQ, Inc., Google and Samsung Mobile US requesting comment on the above statements and other direct questions.

I have a quote from a telephone conversation with Samsung technical support that I am hoping to be able to release soon. After receiving the statement in response to a question about CarrierIQ I sought legal advice and was advised to give Samsung Mobile US's PR company, Edelman PR, the opportunity to comment on it prior to making it public.

 

[twolostminds]

I received a response yesterday to my questions about the capabilities of CIQ from a group that has disassembled IQAgent & CarrierIQ.

We have actually disassembled IQAgent/carrierIQ and captured its behavior to find exactly what it is sending back to sprint on the samsung optimus phone. The information we found it to collect was basic, such as cell towers, signal strengths, device battery. Nothing alarming on that phone, but Sprint could send a remote update to enable the surveillance features without the owner being aware.
Now while the above statement is about the Optimus, I was able to confirm through another source that IQAgent & CarrierIQ data collection and transmission capabilities are basically set the same across all Sprint Android offerings. (exception Nexus S)

Lets recap
IQAgent & CarrierIQ run as a backgroud service on boot.
CarrierIQ logging is set to OFF
CarrierIQ is collecting data and transmitting it on the fly without logging it.
The data CarrierIQ is collecting is basic metrics.
The surveillance capabilities of CarrierIQ can be activated through remote update running in the background at any time by Sprint.

hmmmmmm very interesting.

 

[twolostminds]

I am actually quite surprised by the apathy of Android users and consumers in general when it comes to privacy and protecting their personal information.
In just a few months this software has gone from 90 Million installations to over 150 Million across multiple smartphones, feature phones, tablets, etc...
Your next phone will most likely have CarrierIQ or a similarly capable software installed on it unless we make our voices heard now.